Scammers hijack real Shopify notifications to swindle victims here's how to stay safe

Date:
Fri, 14 Aug 2026 15:15:00 +0000

Description:
Would you recognize a fake notification if it came directly from Shopify?
Some scammers are betting you wouldn't.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Huntress uncovers Shopify
refund scam using fake orders and app notifications Attackers embed contact details in shipping addresses to trick victims into paying Users advised to ignore suspicious info, verify refunds, and report fake stores Hackers are targeting businesses and individuals running Shopify stores with a highly sophisticated fake refund scam, experts have warned.

Security researchers at Huntress outlined how the fake refund scam works: first, a victim gets a notification that they received a refund. It could be for a returned iPhone, or a canceled service or order. The refund can be anywhere from a few hundred, to a few thousand dollars. Soon after, the scammers call (or mail) the victim, say they work at the company that gave
the erroneous refund, and convince the victim to return the funds. If the victim complies, they are actually sending their own money to the victims, since the refund part never happened. Latest Videos From TechRadar Watch full video here: Abusing Shopify's infrastructure There are a couple of ways to pull this attack off: sometimes the scammers really make the initial transaction, but are able to cancel it and return the funds; in other scenarios, they create spoofed pages showing the transactions, tricking those slightly more gullible.

In most cases, fake refund scams can be spotted relatively easily, which is why they are not that popular nowadays. However, this new campaign comes with a sinister twist that will make even hardened veterans wince. You may like
New 'scareware' attack hits 2.8 million victims, pretending to lock them out of your browser Experts flag Bank of America phishing scam that hands your device over to hackers Fake Boots giveaway reached nearly 9 million inboxes

Huntress report notes the attackers start by creating a Shopify store of
their own (or use a compromised one). The one the researchers observed was called My Store and was later deleted before it could be further scrutinized. Then, the attackers make a fake order themselves, setting their targets as
the recipients using their phone numbers, or email addresses.

This type of information isnt that difficult to come by these days. There are hundreds of email and phone number databases leaked on the dark web, which
can be picked up for free (or for a handful of dollars). When they submit the purchase order, a notification appears in the victims Shop apps. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting
your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Yes, thats right. In the Shopify app itself. Coming through Shopify infrastructure. As such, it can easily be confused for an authentic notification. It is even worse for users that enabled push notifications on their mobile phones, since theyll see a notification with the Shopify logo, next to all the other notifications on their phone.

But the attackers still need to pull off the hardest part - getting the
victim to return the money. In this case, instead of calling or messaging them, they leave their contact information in the shipping address, hoping victims would panic and reach out themselves.

In one shared example, the shipping address was listed as: Owen Nolan 2856 If You Didnt Place This Order Call Us at 1_888_690_3420-, Albany NY United
States 1_888_690_3420. What to read next Devious phishing campaign hijacks a genuine Meta business feature to send scam emails as they really do come
from Meta's own address How scammers use "scraped New York Times content" to trick security scanners Security experts warn of AI-boosted scam campaigns that can trick even the smartest victims

For those treading carefully through the internets wastelands, the message included in the shipping address is an immediate red flag. Grammar mistakes, all letters capitalized, and a phone number completely out of place should be quite an obvious sign of an attempted fraud. However, since these kinds of scams bet on people being fast, reckless, overworked, and afraid, it might just work.

Huntress did not say if the scam made any meaningful impact among the
Shopifys community, or if it targeted a specific subgroup of users. Defending against fake refund scams To protect against such attacks, the researchers advise users never interact with phone numbers, email addresses, or links contained in an order that arent recognizable. They also advise users concerned about the security of their SHop account or personal data to
contact support, and stress users should check their bank accounts to confirm whether they were actually changed. If they werent, they can report the order as Not my order in the shop app.

Finally, when purchasing from a store on Shop in general, users should check the store and its product reviews to learn about other customers experiences. If users are concerned that a product or store could be fake, it can easily
be reported. Many of the shops in this scam were brand-new, with some using a "coming soon" description, as well. The best antivirus for all budgets Our
top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/scammers-hijack-real-shopify-notificati ons-to-swindle-victims-heres-how-to-stay-safe


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)